How do I install the watchtower mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

SSyncDev

Start a project

Watchtower MCP Server

Cost tracking + deep security scanning (live RLS cross-tenant probe, leaked-key verification) for AI builders. MCP server for Claude Code.

Local serverstdio

What is the Watchtower MCP Server?

Cost tracking + deep security scanning (live RLS cross-tenant probe, leaked-key verification) for AI builders. MCP server for Claude Code.

The short version

No URL to paste. No data uploaded. No deploy required. Runs locally in your Claude Code agent loop.

What it needs from you

Node.js 18+ - Claude Code (or any MCP-compatible client) - For the RLS audit: a Postgres/Supabase connection string with permission to read schema and (ideally) the authenticated/anon roles. No psql install required.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
watchtower_sync_usage	Import real token usage automatically from Claude Code's own session logs (~/.claude/projects). Accurate, no manual logging. Run it anytime — already-imported e
watchtower_spend	View spending (today / week / month, calendar-aligned) with per-model breakdown and how much is estimated
watchtower_budget	Set daily/weekly/monthly budget alerts (warns at 80% and 100%)
watchtower_log_usage	Manual fallback for non-Claude-Code clients. Prefer sync_usage.
watchtower_scan_secrets	Scan source for hardcoded keys/tokens (pure-Node, no shell). Pass verify: true to confirm which keys are actually live via a read-only call to each vendor.
watchtower_scan_supabase	Audit Postgres/Supabase RLS correctness — runs a live, read-only cross-tenant probe to prove whether a random user or the anonymous role can read other users' d
watchtower_scan_headers	Scan a deployed URL for missing security headers (CSP, HSTS, X-Frame-Options, etc.)
watchtower_status	Quick overview of spending + recent security findings
watchtower_scan_history	History of past security findings (de-duplicated)

How to install the Watchtower MCP Server

{
  "mcpServers": {
    "watchtower": {
      "command": "watchtower-mcp"
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Configuration

Node.js 18+ - Claude Code (or any MCP-compatible client) - For the RLS audit: a Postgres/Supabase connection string with permission to read schema and (ideally) the authenticated/anon roles. No psql install required.

Example prompts to try

“Use Watchtower to Dashboard.”

Frequently asked questions

Cost tracking + deep security scanning (live RLS cross-tenant probe, leaked-key verification) for AI builders. MCP server for Claude Code. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.